Add custom image handling and access policy management

- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected.
- Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies.
- Add NAT network configuration with validation for RFC1918 compliance and subnet parsing.
- Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers.
- Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests.
- Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives.
- Include comprehensive tests for all new functionalities to ensure reliability and correctness.

backend/internal/api/routing.go

@@ -22,6 +22,11 @@ type nat4PortRange struct {
 	End   int `json:"end"`
 }
 
+type nat4Networks struct {
+	LXC config.NATNetwork `json:"lxc"`
+	KVM config.NATNetwork `json:"kvm"`
+}
+
 type nat4Route struct {
 	ContainerID   int    `json:"container_id"`
 	ContainerName string `json:"container_name"`
@@ -72,6 +77,8 @@ type ipv6Route struct {
 type routingResponse struct {
 	NAT4                routeCapacity        `json:"nat4"`
 	NAT4PortRange       nat4PortRange        `json:"nat4_port_range"`
+	NAT4NextPort        int                  `json:"nat4_next_port"`
+	NAT4Networks        nat4Networks         `json:"nat4_networks"`
 	IPv4                routeCapacity        `json:"ipv4"`
 	LANDHCP             routeCapacity        `json:"lan_dhcp"`
 	IPv6                routeCapacity        `json:"ipv6"`
@@ -237,6 +244,7 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 	if nat4Remaining < 0 {
 		nat4Remaining = 0
 	}
+	nat4NextPort, _ := config.PreviewSSHPortExcluding(nil)
 
 	prefixes := lxc.DetectPublicIPv6Prefixes()
 	hostPublicIPv4 := lxc.DetectPublicIPv4()
@@ -262,6 +270,11 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 				Start: nat4StartPort,
 				End:   nat4EndPort,
 			},
+			NAT4NextPort: nat4NextPort,
+			NAT4Networks: nat4Networks{
+				LXC: config.LXCNATNetwork(),
+				KVM: config.KVMNATNetwork(),
+			},
 			IPv4: routeCapacity{
 				Used:      ipv4Used,
 				Remaining: strconv.Itoa(ipv4Remaining),